[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2020108292A1 - 虚拟私有云通信系统、系统配置方法及控制器 - Google Patents

虚拟私有云通信系统、系统配置方法及控制器 Download PDF

Info

Publication number
WO2020108292A1
WO2020108292A1 PCT/CN2019/117498 CN2019117498W WO2020108292A1 WO 2020108292 A1 WO2020108292 A1 WO 2020108292A1 CN 2019117498 W CN2019117498 W CN 2019117498W WO 2020108292 A1 WO2020108292 A1 WO 2020108292A1
Authority
WO
WIPO (PCT)
Prior art keywords
configuration information
vpc
resource
switch
controller
Prior art date
Application number
PCT/CN2019/117498
Other languages
English (en)
French (fr)
Inventor
蒋顺桥
Original Assignee
北京金山云网络技术有限公司
北京金山云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京金山云网络技术有限公司, 北京金山云科技有限公司 filed Critical 北京金山云网络技术有限公司
Priority to SG11202105560WA priority Critical patent/SG11202105560WA/en
Publication of WO2020108292A1 publication Critical patent/WO2020108292A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present application relates to the field of virtual private cloud technology, in particular to a virtual private cloud communication system, system configuration method and controller.
  • Virtual private cloud (VPC, Virtual Private) is a dynamic configuration pool of public cloud computing resources. It needs to use encryption protocols, tunneling protocols and other security procedures to transfer data between private enterprises and cloud service providers.
  • the VPC system is realized by using tunnels or other similar network protocols, and the resources on the cloud are cut according to the tenant's granularity, thereby providing different tenants with on-demand supply capacity, while having strong flexibility, isolation, and security .
  • VM Virtual Machine
  • the implementation solution is to use CPU (Central Processing Unit), Memory (Memory), Disk (disk) and other resource virtualization technologies abstract the original physical machine (VM host) into finer-grained individuals and place them in VPCs divided by tenant.
  • GPU-consuming tasks such as image, sound, and video processing can be distributed on the physical machine (PM, Physical) machine, and some control processing programs can be placed in the VM, which is done by the PM and the VM Balanced allocation of resources.
  • the communication between the tenants and the isolation between the tenants are particularly important.
  • the communication and isolation are performed by VLAN (Virtual Local Area Network), but because of the VLAN ID Number) has a number limit, when the number of VPCs to be built exceeds the upper limit of the number of VLANs, no more VPCs can be built. Therefore, in the field of cloud computing services, for cloud computing providers, due to the huge number of tenants, the number of corresponding VPCs to be built is far greater than the upper limit of the number of VLANs. Therefore, VLANs are used in the prior art The ID method to isolate tenants does not satisfy the application environment in cloud computing.
  • the purpose of this application is to provide a virtual private cloud communication system, a system configuration method and a controller to establish a communication connection based on a gateway, without being limited to the upper limit of the number of VLANs and assigning VMs to tenants
  • the number of PMs and PMs can increase with the increase of tenants, thus forming a large-scale cloud environment together to meet the current business development needs.
  • an embodiment of the present application provides a virtual private cloud communication system, including: at least one virtual machine VM and a system gateway communicatively connected to each of the VMs;
  • the system gateway is in communication connection with the switch
  • the system gateway and the switch are used to enable communication between the VM and the PM in the same virtual private cloud VPC based on preset configuration information.
  • the configuration information includes an isolation label corresponding to the VPC
  • the configuration information further includes a forwarding entry corresponding to the resource included in the VPC;
  • the resources include: VM and/or PM.
  • the system further includes a controller
  • the controller is in communication connection with the system gateway and the switch respectively;
  • the controller is configured to separately configure the system gateway and the switch, generate configuration information, and send the configuration information to the system gateway and the switch, respectively.
  • controller is also used to:
  • the resources include VM and/or PM;
  • controller is also used to:
  • the forwarding entry of the PM is established based on the IP address of the PM.
  • controller is also used to:
  • controller is also used to:
  • controller is also used to:
  • the configuration information corresponding to the VPC to be managed is deleted based on the total resource deletion request.
  • system gateway is used for:
  • the first message includes an isolation label
  • the system gateway is also used to:
  • the switch is used to:
  • the third message includes an isolation label
  • the switch is also used to:
  • system gateway is implemented by running corresponding software in the server.
  • the embodiments of the present application also provide a system configuration method of a virtual private cloud communication system, which is applied to a controller in the system of the virtual private cloud communication system described in the first aspect and any possible implementation manner ,
  • the controller is in communication with the system gateway and the switch, and the method includes:
  • the configuration information includes an isolation label corresponding to the VPC; the configuration information further includes a forwarding entry of a resource included in the corresponding VPC; the resource includes: VM and/or PM.
  • the step of generating configuration information includes:
  • the resources include VM and/or PM;
  • the step of establishing a forwarding entry based on the IP address of the resource includes:
  • the forwarding entry of the PM is established based on the IP address of the PM.
  • the method further includes:
  • the method further includes:
  • the management operation request includes one or more of a resource increase request, a resource partial deletion request, and a resource all deletion request.
  • the method further includes:
  • the configuration information corresponding to the VPC to be managed is deleted based on the total resource deletion request.
  • an embodiment of the present application further provides a controller, including a memory and a processor, a computer program that can be run on the processor is stored on the memory, and the processor is implemented when the computer program is executed.
  • an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described above is implemented.
  • an embodiment of the present application further provides an application program for execution at runtime: the system configuration method of the virtual private cloud communication system provided in the second aspect of the embodiment of the present application.
  • the virtual private cloud communication system includes at least one virtual machine VM and a system gateway communicatively connected to each VM; at least one physical machine PM and a switch communicatively connected to each PM; the system gateway and the switch Communication connection; the system gateway and the switch are used to enable communication between VMs and PMs in the same virtual private cloud VPC based on preset configuration information.
  • the physical machine area formed by the PM is connected to the network through the switch, and the virtual machine area formed by the VM is connected to the switch corresponding to the physical machine area through the system gateway, thereby establishing the relationship between the PM of the physical machine area and the VM of the virtual machine area.
  • connection between the VM and the PM is realized; therefore, the communication connection established based on the gateway in this application does not need to be limited to the upper limit of the number of VLANs, and the number of VMs and PMs allocated to the tenant can be With the increase of tenants, it will form a large-scale cloud environment and meet the current business development needs.
  • FIG. 1 is a schematic structural diagram of a virtual private cloud communication system provided by an embodiment of this application.
  • FIG. 2 is a schematic structural diagram of another virtual private cloud communication system provided by an embodiment of this application.
  • FIG. 3 is a schematic diagram of a communication connection of a virtual private cloud communication system provided by an embodiment of this application;
  • FIG. 5 is a schematic structural diagram of a controller provided by an embodiment of the present application.
  • VLAN is used for communication and isolation.
  • the VM and PM allocated to the tenant cannot form a large-scale cloud environment, and then face more and more Tenants cannot meet current business development needs.
  • a virtual private cloud communication system, system configuration method and controller provided by the embodiments of the present application establish a communication connection between a VM and a PM based on a gateway. Since VLANs are no longer used to isolate LANs, there is no need to be restricted Due to the upper limit of the number of VLANs, the number of VMs and PMs allocated to tenants can increase with the increase of tenants, thus forming a large-scale cloud environment together to meet the current business development needs
  • FIG. 1 shows a schematic structural diagram of a virtual private cloud communication system provided by an embodiment of the present application.
  • the virtual private cloud communication system includes at least one virtual machine VM 10 and a system gateway 12 communicatively connected to each VM; at least one physical machine PM 13 and a switch 14 communicatively connected to each PM; a system gateway Communicating with the switch, the system gateway and switch are used to enable communication between the VM 10 and PM 13 in the same virtual private cloud VPC based on preset configuration information.
  • the aforementioned PM refers to a physical machine other than the VM host machine.
  • the switch 14 is a three-layer switch and supports a tunneling protocol for subsequent data transmission through the tunnel.
  • the VM is created on the physical machine as the host machine to realize resource virtualization, which can be but not limited to storage control processing programs.
  • the PM (host machine where the VM is not located) may be, but not limited to, used to store GPU-consuming task information such as images, sounds, and video processing. Data exchange can be performed between the virtual machine area formed by the VM corresponding to the same tenant and the physical machine area formed by the PM.
  • the above system gateway is implemented by running corresponding software in a server (for example, an X86 server). Since the virtual private cloud communication system may correspond to tens of thousands of tenants, the system gateway is implemented through an X86 server cluster to form a system gateway cluster.
  • a server for example, an X86 server. Since the virtual private cloud communication system may correspond to tens of thousands of tenants, the system gateway is implemented through an X86 server cluster to form a system gateway cluster.
  • VMs virtual machines
  • PMs physical devices
  • system gateways switches
  • switches switches
  • the physical machine area formed by the PM is connected to the network through the switch, and the virtual machine area formed by the VM is connected to the switch corresponding to the physical machine area through the system gateway, thereby establishing the relationship between the PM of the physical machine area and the VM of the virtual machine area
  • the connection between the VM and the PM is realized; therefore, the communication connection established based on the gateway in this application does not need to be limited to the upper limit of the number of VLANs, and the number of VMs and PMs allocated to the tenant can be The increase of tenants increases, thereby forming a large-scale cloud environment, which meets the current business development needs.
  • configuration information is stored in the controller, and the configuration information includes an isolation tag for isolating the VPC, where , One VPC corresponds to one isolation label.
  • the above configuration information includes the isolation label corresponding to the above VPC; in addition, the configuration information also includes the forwarding entry of the resource included in the corresponding VPC, whereby the system gateway and the switch can be based on the forwarding entry and the isolation label, Realize the communication between VM and PM of the same VPC.
  • the IP of VM-A and PM-A of tenant A is 10.0.1.2/24, 10.0.0.3/24, and the label is 100.
  • the IP of VM-B and PM-B of tenant B is also 10.0.1.2/ 24. 10.0.1.3/24, the label is 200.
  • the system gateway and the switch are shared during the communication process. If isolation technology is not used, path conflicts may occur between the VMs and PMs of Tenant A and Tenant B, resulting in abnormal communication.
  • tenant A and tenant B Since the tenant can set the IP of the machine by himself, there is a possibility that tenant A and tenant B set their VM or PM IP to the same, in order to avoid confusion between tenant A's machine and tenant B's machine, At this time, for the service provider, it is necessary to distinguish the machines of the two tenants.
  • the controller can assign isolation labels to each tenant's VPC, and then the controller simultaneously delivers the isolation labels to the forwarding entries corresponding to the PM and VM to each system gateway and switch.
  • the controller can isolate the communication path by encapsulating the isolation label in the forwarding entry.
  • the present application also provides another virtual private cloud communication system.
  • the virtual private cloud communication system further includes a controller 20 The controller communicates with the system gateway and the switch, configures the system gateway and the switch, generates configuration information, and sends the configuration information to the system gateway and the switch, respectively, to facilitate subsequent data transmission.
  • the controller is connected to an out-of-band management system corresponding to the host machine where the VM is located and the PM, and the host machine and the out-of-band management system perform resource configuration and information configuration according to the tenant's needs, and obtain configuration information
  • the above out-of-band management system refers to a management system that initializes the PM (for example, reinstalls the operating system), and the specific process is as follows:
  • the tenant can directly call the corresponding API (Application Programming Interface) through the tenant terminal (which can be a mobile terminal or a computer), or log in to the WEB (World Wide Web, Global Wide Area Network) console to call the corresponding API .
  • the corresponding demand information according to the actual demand, such as the type of CPU required, memory size, network card requirements, etc., so as to generate a resource creation request and send it to the controller.
  • the resources of the VPC include VM and/or PM, that is, the VM and/or PM constitute the tenant's VPC.
  • the controller After receiving the resource creation request, the controller performs logical calculation to determine the required resources, and allocates available resources in the resource pool (host and PM) through the host's management unit and out-of-band management system. If it is determined that there are resources that meet the requirements, the configuration operation is performed, and a corresponding number of VMs and/or PMs are allocated. The VMs and/or PMs constitute the VPC corresponding to the tenant; if there are no resources that meet the requirements, the resource shortage information is returned to the customer, etc. information.
  • the controller may select a PM that meets the above requirements from the resource pool as the target host according to the type of CPU required in the resource creation request, the memory size, and the transmission rate of the network card. This is the logical calculation process mentioned above. Then, the controller can create a VM in the target host.
  • the resource pool includes multiple types of PMs, some PMs can be used as host machines, and some PMs can be used for image, sound, and video processing. These PMs can only contain GPUs, and can be available in tenants. When GPUs are used, such as image, sound, and video processing requirements, these GPUs can be directly assigned to tenants as PMs.
  • the above-mentioned management unit of the host refers to a unit that manages the configuration parameters of each VM in the host PM
  • the out-of-band management system refers to a management system that initializes the PM (for example, reinstalls the operating system).
  • the out-of-band management system can operate independently of the network shown in Figure 2 and can interact with the controller. It can be understood that, since the management unit is used to manage the VM in the host machine, and the out-of-band management system is used to manage the PM, the controller can interact with the management unit and the out-of-band management system in the resource pool Choose a PM that meets the tenant's needs as the host.
  • the isolation label may be composed of corresponding numbers, letters and/or special symbols.
  • the resource includes VM and/or PM
  • the IP address includes the IP address of the VM and the IP address of the PM, that is, the IP address obtained above refers to the IP address of the VM and/or PM belonging to the same VPC .
  • the network segment where the PM and the VM are located can be customized. For example, by calling the corresponding API, IP configuration is performed on the VM and PM in the VPC, and the corresponding IP information is sent to the controller.
  • the VM When the VM is in communication with the system gateway, the VM can automatically obtain its corresponding IP.
  • the PM When the PM communicates with the system gateway through the switch, the PM can also automatically obtain its corresponding IP.
  • the above IP configuration may be specifically implemented through a DHCP (Dynamic Host Configuration Protocol) server in the system gateway.
  • DHCP Dynamic Host Configuration Protocol
  • the VM and PM When the VM and PM are powered on, the VM and PM act as DHCP clients to interact with the DHCP server to obtain corresponding IP.
  • the process of establishing the forwarding entry specifically includes: establishing the forwarding entry of the VM based on the IP address of the VM, and/or establishing the forwarding entry of the PM based on the IP address of the PM.
  • the forwarding entry of the PM includes the source IP address of the source PM and the target IP address of the target PM
  • the forwarding entry of the VM includes the source IP address of the source VM and the target IP address of the target VM.
  • the controller After obtaining the isolation label of the tenant's VPC and the forwarding entry of the VM and/or the forwarding entry of the PM in the VPC, generate configuration information (the configuration information includes the forwarding entry of the VM and/or the forwarding entry of the PM , And isolation label information). After generating the configuration information, the controller configures the configuration information to the system gateway and switch to facilitate data transmission (that is, data packet forwarding).
  • the controller is also used to manage resources in the virtual private cloud VPC based on the configuration information. This management includes: adding resources and/or deleting resources. That is, the controller tenant can add the VM or PM in the VPC, or delete the VM and PM in the VPC.
  • the above controller is also used to: (1) receive a management operation request for resources in the VPC; wherein, the management operation request includes the isolation tag corresponding to the VPC to be managed; (2) according to the isolation tag Modify the configuration information corresponding to the VPC to be managed in the system gateway and switch.
  • the above management operation request may include, but is not limited to, a resource increase request, a resource partial deletion request, and a resource all deletion request.
  • the above controller is also used to add forwarding entries corresponding to resource IP addresses based on resource addition requests; and/or delete forwarding entries corresponding to resource IP addresses based on resource partial deletion requests; and/or delete all based on resources Request to delete the configuration information corresponding to the VPC to be managed.
  • the specific processing procedure of the resource increase request by the above controller includes:
  • the resource increase request includes the isolation tag corresponding to the VPC to be added.
  • the tenant can directly call the corresponding API through the tenant terminal (which can be a mobile terminal or a computer), or log in to the WEB console to call the corresponding API.
  • the tenant terminal which can be a mobile terminal or a computer
  • log in to the WEB console to call the corresponding API.
  • a forwarding entry is established for the corresponding VM and/or, and the forwarding entry is added to the configuration information of the VPC to be added.
  • the configuration information may be generated according to the steps (a1) to (a6).
  • the above controller's request to delete part of the resource includes:
  • step (b1) and step (b3) above delete the forwarding entry corresponding to the resource to be deleted in the VPC in the existing configuration information, and then send the updated configuration information to the system gateway and switch.
  • the controller can directly control the system gateway and switch to delete the configuration information of the VPC to be managed according to the isolation label in the resource all deletion request.
  • the controller after receiving the above resource deletion request or resource partial deletion request, changes the configured VM and PM from the configured state through the host corresponding to the VM and the out-of-band management system corresponding to the PM It is not configured to facilitate subsequent recycling.
  • VPCs of different tenants can be isolated without interfering with each other, providing security protection capabilities for each VPC; at the same time, when deleting and adding operations can be implemented, only the operation of the The configuration information of the VPC corresponding to the tenant is updated without affecting the configuration information of other tenants, which increases the flexibility of the tenant to add and delete VMs and PMs in the VPC.
  • the system gateway is used to: receive the first packet of the VM; the first packet includes the isolation label; find the configuration information corresponding to the isolation label based on the isolation label in the first packet, Based on the found configuration information, the first packet is forwarded to the corresponding switch.
  • the system gateway is also used to receive the second message of the switch; wherein, the second message includes an isolation label; and the isolation label is found and isolated based on the isolation label in the second message Corresponding configuration information, and forward the second packet to the target VM based on the found configuration information.
  • the switch In the transmission process from the PM to the VM, the switch is used to receive the third packet of the PM; wherein, the third packet includes the isolation label; based on the isolation label in the third packet, the configuration information corresponding to the isolation label is found, Based on the found configuration information, the third packet is forwarded to the corresponding system gateway.
  • the switch is also used to receive the fourth message of the above-mentioned system gateway; wherein, the fourth message includes the isolation label; based on the isolation label in the fourth packet, a corresponding to the isolation label is found Based on the found configuration information, and forwards the fourth packet to the target PM based on the found configuration information.
  • the virtual private cloud communication system may also be connected to a public network such as the Internet.
  • a public network such as the Internet.
  • VM is connected to the public network through the network gateway 30.
  • the PM in the virtual private cloud system is sequentially connected to the public network through the corresponding switch, system gateway, and network gateway 30.
  • system gateway implementation and configuration management In the system described above, it mainly involves two parts: system gateway implementation and configuration management, and PM switch configuration and management.
  • PM and PM PM and other network elements (including VM, Internet (Internet)) communication
  • the switch is a wire-speed forwarding device. Its pressure is mainly reflected in large-scale configuration and management.
  • the system gateway is a gateway implemented by software running on X86. Its performance is not as good as that of a switch. Its pressure is mainly reflected in network forwarding.
  • the forwarding entries on the switch In the large-scale environment of the physical machine area formed by the PM, the forwarding entries on the switch also increase exponentially. If you rely on flood control learning between devices, it will bring broadcast storms and consumption in the physical machine area. Corresponding bandwidth.
  • the switch only supports Layer 2 forwarding equipment, that is, Layer 2 forwarding equipment, in order to support inter-PM communication across Layer 3, all the gateways required by PM will be implemented by the system gateway, that is, must pass through the system gateway, so it is the system gateway Bring greater pressure.
  • the switch is a layer 3 switch that supports the tunnel protocol and supports layer 3 forwarding. It cooperates with EVPN (Ethernet Virtual Private Network) technology to synchronize forwarding entries between switches In order to transfer the gateway required by the PM from the system gateway to the switch, thereafter the communication between the PMs can be directly forwarded through the switch.
  • EVPN Ethernet Virtual Private Network
  • System gateway forwarding performance The forwarding performance of the system gateway depends entirely on the implementation of the software architecture. If Linux kernel forwarding is used, due to the large and cumbersome Linux protocol stack, it is bound to be unsatisfactory in handling network forwarding.
  • the DPDK (Data Plane Development Kit) technology allows network forwarding logic to be implemented in the tenant space of the Linux system, bypassing the Linux network protocol stack and allowing the system gateway forwarding program to directly operate the network card to obtain and send data Packets can greatly improve data processing performance and throughput. Therefore, in the subsequent message forwarding process, DPDK technology can be used.
  • the virtual private cloud system in this application establishes a communication bridge between the physical machine area and the virtual machine area and the public network (such as the Internet), which enables the resources in the virtual machine area and the physical machine area to form a large-scale VPC without being restricted
  • the public network such as the Internet
  • the embodiments of the present application also provide a system configuration method of a virtual private cloud communication system, which is applied to the controller as in the above system embodiments, as shown in FIG. 4, the virtual The system configuration method of the private cloud communication system includes:
  • Step S401 separately configuring information on the system gateway and the switch to generate configuration information
  • Step S402 Send the configuration information to the system gateway and the switch respectively;
  • the configuration information includes an isolation label corresponding to the VPC; the configuration information further includes a forwarding entry of a resource included in the corresponding VPC; the resource includes: VM and/or PM.
  • the step of generating configuration information in the above step S402 includes: generating an isolation label corresponding to the VPC based on each virtual private cloud VPC; obtaining an IP address of a resource belonging to the same virtual private cloud VPC; establishing a forwarding entry based on the IP address of the resource ; Generate configuration information corresponding to VPC based on forwarding entries and isolation labels.
  • the step of establishing a forwarding entry based on the resource IP address includes: establishing a forwarding entry of the VM based on the IP address of the VM, and/or establishing a forwarding entry of the PM based on the IP address of the PM.
  • the above method further includes: managing resources in the virtual private cloud VPC based on the above configuration information; the management includes: adding resources and/or deleting resources.
  • the above method further includes: receiving a management operation request for resources in the VPC; wherein the management operation request includes an isolation label corresponding to the VPC to be managed; and modifying the system gateway and switch corresponding to the VPC to be managed according to the isolation label Configuration information.
  • the above management operation request includes one or more of a resource addition request, a resource partial deletion request, and a resource all deletion request.
  • the above method further includes: adding a forwarding entry corresponding to the resource IP address based on the resource addition request; and /Or delete the forwarding entry corresponding to the resource IP address based on the partial resource deletion request; and/or delete the configuration information corresponding to the VPC to be managed based on the complete resource deletion request.
  • the switch of the virtual private cloud communication system is a layer 3 switch that supports the tunnel protocol; the above-mentioned virtual private cloud communication method further includes: using EVPN technology to synchronize the corresponding PM Forwarding entries between switches to transfer the gateways required by the PM from the system gateway to the switches, and thereafter the communication between the PMs can be directly forwarded through the switches, effectively reducing the forwarding pressure of the system gateway.
  • an embodiment of the present application further provides a controller 100, including: a processor 40, a memory 41, a bus 42, and a communication interface 43.
  • the processor 40, the communication interface 43, and the memory 41 are connected by a bus 42;
  • the device 40 is used to execute an executable module stored in the memory 41, such as a computer program.
  • the memory 41 may include a high-speed random access memory (RAM, Random Access Memory), or may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.
  • RAM Random Access Memory
  • non-volatile memory such as at least one disk memory.
  • the communication connection between the system network element and at least one other network element is achieved through at least one communication interface 43 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.
  • the bus 42 may be an ISA bus, a PCI bus, an EISA bus, or the like.
  • the bus can be divided into an address bus, a data bus, and a control bus. For ease of representation, only one bidirectional arrow is used in FIG. 5, but it does not mean that there is only one bus or one type of bus.
  • the memory 41 is used to store a program, and the processor 40 executes the program after receiving the execution instruction.
  • the method executed by the apparatus defined by the flow process disclosed in any of the embodiments of the present application may be applied to processing Processor 40, or implemented by processor 40.
  • the processor 40 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 40 or instructions in the form of software.
  • the processor 40 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; or a digital signal processor (DSP). ), application specific integrated circuit (Application Specific Integrated Circuit, ASIC for short), ready-made programmable gate array (Field-Programmable Gate Array, FPGA for short) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • the general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied and executed by a hardware decoding processor, or may be executed and completed by a combination of hardware and software modules in the decoding processor.
  • the software module may be located in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, and registers.
  • the storage medium is located in the memory 41, and the processor 40 reads the information in the memory 41 and completes the steps of the above method in combination with its hardware.
  • the system configuration method and controller of the virtual private cloud communication system provided by the embodiments of the present application have the same technical features as the virtual private cloud communication system provided by the above embodiments, so they can also solve the same technical problems and achieve the same technical effect .
  • Embodiments of the present application also provide a computer-readable storage medium, and a computer program is stored in the computer-readable storage medium to perform the system configuration method of the virtual private cloud communication system described in the foregoing method embodiments.
  • the computer program product for performing a system configuration method includes a computer-readable storage medium storing non-volatile program code executable by a processor, and the instructions included in the program code may be used to perform the foregoing method implementation
  • a computer-readable storage medium storing non-volatile program code executable by a processor
  • the instructions included in the program code may be used to perform the foregoing method implementation
  • each block in the flowchart or block diagram may represent a module, program segment, or part of code that contains one or more of the Executable instructions.
  • the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in reverse order, depending on the functions involved.
  • each block in the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts can be implemented with dedicated hardware-based systems that perform specified functions or actions Or, it can be realized by a combination of dedicated hardware and computer instructions.
  • the disclosed system and method may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a division of logical functions.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some communication interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a non-volatile computer-readable storage medium executable by a processor.
  • a computer device which may be a personal computer, server, or network device, etc.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种虚拟私有云通信系统、系统配置方法及控制器，该系统包括至少一个虚拟机VM以及与每个VM通信连接的系统网关；至少一个物理机PM以及与每个PM通信连接的交换机；系统网关与交换机通信连接；系统网关和所述交换机用于基于预设的配置信息使属于同一个虚拟私有云VPC内的VM与PM之间能够进行通信。该方式中，由PM形成的物理机区域通过交换机接入网络，由VM形成的虚拟机区域通过系统网关连接物理机区域对应的交换机，从而建立了物理机区域的PM与虚拟机区域的VM之间的连接，实现了VM与PM之间的通信；由此，本申请中基于网关建立的通信连接，无需受限于VLAN ID数量的上限值，满足了当前的业务发展需求。

Description

虚拟私有云通信系统、系统配置方法及控制器
本申请要求于2018年11月30日提交中国专利局、申请号为201811463985.6发明名称为“虚拟私有云通信系统、系统配置方法及控制器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及虚拟私有云技术领域，尤其是涉及一种虚拟私有云通信系统、系统配置方法及控制器。
背景技术
虚拟私有云(VPC，Virtual Private Cloud)是一个公共云计算资源的动态配置池，需要使用加密协议、隧道协议和其他安全程序，在民营企业和云服务提供商之间传输数据。
VPC系统利用隧道或其他相类似的网络协议所实现，将云上资源按照租户为粒度来切割，进而对不同的租户提供按需分配的供给能力，同时具有较强灵活性、隔离性、安全性。目前的虚拟私有云中，云计算提供服务商所提供的计算资源大多数以虚拟机(VM，Virtual Machine)来交付给租户，该实现方案是利用CPU(Central Processing Unit，中央处理器)、Memory(存储器)、Disk(磁盘)等各资源的虚拟化技术，将原有物理机(VM的宿主机)进行抽象划分为更细粒度的个体并放置在按租户划分的VPC中。
上述方案在一台物理机上虚拟多个VM时会引入各个虚拟资源对物理机原有资源(如CPU调度、I/O读写、和网络带宽)的争抢问题。若一台物理机只虚拟一个VM，相对VM而言各方面性能有所提升，但虚拟化技术的引入仍无法达到纯物理机机器原有的性能优势，也无法把整体资源性能发挥到最大化；再者由于近期人工智能行业兴起，对GPU(Graphics Processing Unit，图形处理器)需求量非常之大，GPU的资源虚拟化带来的收益很不明显。
基于上述情况，此时把图像、声音、视频处理等GPU消耗型的任务可以分布在物理机(PM，Physical machine)上处理，而一些控制处理程序可放置在VM中，由PM和VM做到资源的平衡分配。
此时在超大规模的云环境中租户内通信和租户间隔离显得尤为重要，现有方案中处理通信、隔离利用VLAN(Virtual Local Area Network，虚拟局域网)来进行，但是由于VLAN ID(虚拟局域网标识号)有个数限制，当需要搭建的VPC超过VLAN ID数量的上限值时，便不能搭建更多的VPC。因此，在云计算服务领域，对云计算提供商来说，由于租户的数量极大，对应的需要搭建的VPC的数量远远大于VLAN ID数量的上限值，因此，现有技术中采用VLAN ID的方法来隔离租户的方法并不能满足在云计算的应用环境。
发明内容
有鉴于此，本申请的目的在于提供一种虚拟私有云通信系统、系统配置方法及控制器，以基于网关建立的通信连接，无需受限于VLAN ID数量的上限值，为租户分配的VM和PM的数量可以随着租户的增加而增加，从而一起形成大规模的云环境，满足了当前的业务发展需求。
第一方面，本申请实施例提供了一种虚拟私有云通信系统，包括：至少一个虚拟机VM以及与每个所述VM通信连接的系统网关；
至少一个物理机PM以及与每个所述PM通信连接的交换机；
所述系统网关与所述交换机通信连接；
所述系统网关和所述交换机用于基于预设的配置信息使属于同一个虚拟私有云VPC内的所述VM与所述PM之间能够进行通信。
可选的，所述配置信息包括与所述VPC对应的隔离标签；
所述配置信息还包括与对应的所述VPC包括的资源的转发表项；
所述资源包括：VM和/或PM。
可选的，所述系统还包括控制器；
所述控制器分别与所述系统网关和所述交换机通信连接；
所述控制器用于分别对所述系统网关和所述交换机进行信息配置，生成配置信息，并将所述配置信息分别发送至所述系统网关和所述交换机。
可选的，所述控制器还用于：
基于每个虚拟私有云VPC生成与所述VPC对应的隔离标签；
获取属于同一个虚拟私有云VPC的资源的IP地址；所述资源包括VM和 /或PM；
基于资源的IP地址建立转发表项；
根据所述转发表项和所述隔离标签生成与所述VPC对应的配置信息。
可选的，所述控制器还用于：
基于所述VM的IP地址建立所述VM的转发表项，和/或
基于所述PM的IP地址建立所述PM的转发表项。
可选的，所述控制器还用于：
基于所述配置信息管理所述虚拟私有云VPC内的资源；所述资源包括VM和/或PM；所述管理包括：增加资源和/或删除资源。
可选的，所述控制器还用于：
接收对所述VPC内的资源的管理操作请求；其中，所述管理操作请求包括待管理的VPC对应的隔离标签；
根据所述隔离标签修改所述系统网关及所述交换机中与所述待管理的VPC对应的配置信息。
可选的，所述控制器还用于：
基于资源增加请求增加与资源IP地址对应的转发表项；和/或
基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或
基于资源全部删除请求删除与所述待管理的VPC对应的配置信息。
可选的，其中，所述系统网关用于：
接收所述VM的第一报文；所述第一报文包括隔离标签；
基于所述第一报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第一报文转发至对应的交换机；
所述系统网关还用于：
接收所述交换机的第二报文；其中，所述第二报文包括隔离标签；
基于所述第二报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第二报文转发至目标VM。
可选的，所述交换机用于：
接收所述PM的第三报文；所述第三报文包括隔离标签；
基于所述第三报文中的隔离标签找到与所述隔离标签对应的配置信息， 并基于找到的配置信息将所述第三报文转发至对应的系统网关；
所述交换机还用于：
接收所述系统网关的第四报文；其中，所述第四报文包括隔离标签；
基于所述第四报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第四报文转发至目标PM。
可选的，所述系统网关是通过在服务器中运行相应软件实现的。
第二方面，本申请实施例还提供一种虚拟私有云通信系统的系统配置方法，应用于第一方面及其任一种可能的实施方式所述的虚拟私有云通信系统的系统中的控制器，所述控制器分别与所述系统网关和所述交换机通信连接，所述方法包括：
分别对所述系统网关和所述交换机进行信息配置，生成配置信息；
并将所述配置信息分别发送至所述系统网关和所述交换机；
其中所述配置信息包括与所述VPC对应的隔离标签；所述配置信息还包括与对应的所述VPC包括的资源的转发表项；所述资源包括：VM和/或PM。
可选的，所述生成配置信息的步骤，包括：
基于每个虚拟私有云VPC生成与所述VPC对应的隔离标签；
获取属于同一个虚拟私有云VPC的资源的IP地址；所述资源包括VM和/或PM；
基于资源的IP地址建立转发表项；
根据所述转发表项和所述隔离标签生成与所述VPC对应的配置信息。
可选的，所述基于资源的IP地址建立转发表项的步骤，包括：
基于所述VM的IP地址建立所述VM的转发表项，和/或
基于所述PM的IP地址建立所述PM的转发表项。
可选的，所述方法还包括：
基于所述配置信息管理所述虚拟私有云VPC内的资源；所述资源包括VM和/或PM；所述管理包括：增加资源和/或删除资源。
可选的，所述方法还包括：
接收对所述VPC内的资源的管理操作请求；其中，所述管理操作请求包括待管理的VPC对应的隔离标签；
根据所述隔离标签修改所述系统网关及所述交换机中与所述待管理的VPC对应的配置信息。
可选的，所述管理操作请求包括资源增加请求、资源部分删除请求、资源全部删除请求中的一种或者多种，所述方法还包括：
基于资源增加请求增加与资源IP地址对应的转发表项；和/或
基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或
基于资源全部删除请求删除与所述待管理的VPC对应的配置信息。
第三方面，本申请实施例还提供一种控制器，包括存储器、处理器，所述存储器上存储有可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现上述第一方面及其任一种可能的实施方式所述的方法。
第四方面，本申请实施例还提供了一种计算机可读存储介质，所述存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现上述所述的方法。
第五方面，本申请实施例还提供了一种应用程序，用于在运行时执行：本申请实施例第二方面所提供的虚拟私有云通信系统的系统配置方法。
本申请实施例带来了以下有益效果：
在本申请提供的实施例中，虚拟私有云通信系统包括至少一个虚拟机VM以及与每个VM通信连接的系统网关；至少一个物理机PM以及与每个PM通信连接的交换机；系统网关与交换机通信连接；系统网关和所述交换机用于基于预设的配置信息使属于同一个虚拟私有云VPC内的VM与PM之间能够进行通信。该方式中，由PM形成的物理机区域通过交换机接入网络，由VM形成的虚拟机区域通过系统网关连接物理机区域对应的交换机，从而建立了物理机区域的PM与虚拟机区域的VM之间的连接，实现了VM与PM之间的通信；由此，本申请中基于网关建立的通信连接，无需受限于VLAN ID数量的上限值，为租户分配的VM和PM的数量可以随着租户的增加而增加，从而一起形成大规模的云环境，满足了当前的业务发展需求。
本申请的其他特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
为使本申请的上述目的、特征和优点能更明显易懂，下文特举较佳实施例，并配合所附附图，作详细说明如下。
附图说明
为了更清楚地说明本申请实施例和现有技术的技术方案，下面对实施例和现有技术中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种虚拟私有云通信系统的结构示意图；
图2为本申请实施例提供的另一种虚拟私有云通信系统的结构示意图；
图3为本申请实施例提供的一种虚拟私有云通信系统的通信连接示意图；
图4为本申请实施例提供的一种系统配置方法的流程示意图；
图5为本申请实施例提供的一种控制器的结构示意图。
具体实施方式
为使本申请的目的、技术方案、及优点更加清楚明白，以下参照附图并举实施例，对本申请进一步详细说明。显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
目前，现有方案中处理通信、隔离利用VLAN来进行，但是由于VLAN ID数量限制、交换机硬件结构限制，为租户分配的VM与PM不能形成大规模的云环境，进而面对越来越多的租户，不能满足当前的业务发展需求。基于此，本申请实施例提供的一种虚拟私有云通信系统、系统配置方法及控制器，基于网关建立VM与PM之间的通信连接，由于不再利用VLAN对局域网进行隔离，因此无需受限于VLAN ID数量的上限值，为租户分配的VM和PM的数量可以随着租户的增加而增加，从而一起形成大规模的云环境，满足了当前的业务发展需求
为便于对本实施例进行理解，首先对本申请实施例所公开的一种虚拟私有云通信系统进行详细介绍。
图1示出了本申请实施例提供的一种虚拟私有云通信系统的结构示意图。如图1所示，该虚拟私有云通信系统包括至少一个虚拟机VM 10以及与每个VM通信连接的系统网关12；至少一个物理机PM 13以及与每个PM通信连接的交换机14；系统网关与交换机通信连接，系统网关和交换机用于基于预设的配置信息使属于同一个虚拟私有云VPC内的VM 10与PM 13之间能够进行通信。上述PM是指除了VM宿主机之外的物理机。
该交换机14为三层交换机，支持隧道协议，以在后续通过隧道进行数据传输。VM创建在作为宿主机的物理机上，实现资源虚拟化，可以但不限于用于存储控制处理程序。PM(非VM所在的宿主机)可以但不限于用于存储图像、声音、视频处理等GPU消耗型的任务信息。同一租户对应的VM形成的虚拟机区域和PM形成的物理机区域之间可进行数据交换。
在可能的实施例中，上述系统网关是通过在服务器(例如X86服务器)中运行相应软件实现的。由于该虚拟私有云通信系统可能对应成千上万的租户，该系统网关通过X86服务器集群实现，以形成系统网关集群。
需要说明的是，VM、PM、系统网关及交换机的具体数量，根据实际情况而定，图1中仅是示例性的。
该方式中，由PM形成的物理机区域通过交换机接入网络，由VM形成的虚拟机区域通过系统网关连接物理机区域对应的交换机，从而建立了物理机区域的PM与虚拟机区域的VM之间的连接，实现了VM与PM之间的通信；由此本申请中基于网关建立的通信连接，无需受限于VLAN ID数量的上限值，为租户分配的VM和PM的数量可以随着租户的增加而增加，从而一起形成大规模的云环境，满足了当前的业务发展需求。
考虑到不同租户对其VPC中的资源(包括VM和/或PM)配置的IP可能出现重叠问题，在控制器中保存有配置信息，该配置信息包括用于对VPC进行隔离的隔离标签，其中，一个VPC对应一个隔离标签。
因此在接收到租户的资源创建请求后，进行逻辑运算，按照不同租户的不同VPC来分配隔离标签，以区分不同VPC中的VM及PM，以使不用VPC之间彼此隔离，互不干扰。基于此，上述配置信息包括与上述VPC对应的隔离标签；另外，配置信息还包括与对应的VPC包括的资源的转发表项，由此， 系统网关和交换机可以基于该转发表项及隔离标签，实现同一VPC的VM与PM之间的通信。
例如：租户A的VM-A、PM-A的IP分别为10.0.1.2/24、10.0.1.3/24，标签为100，租户B的VM-B、PM-B的IP也为10.0.1.2/24、10.0.1.3/24，标签为200。假设两个租户的VM在虚拟机区域内的同一台宿主机以及两个租户的PM对应连接同一台交换机时，当VM-A与PM-A、VM-B与PM-B互相通信时需要经过同一台宿主机，再通过系统网关到达同一台交换机。在该两条通信路径中，系统网关和交换机在通信过程中都是共享的，若不采用隔离技术，则租户A、租户B的VM和PM通信时可能会出现路径冲突从而导致通信异常。
由于租户可以自行设置机器的IP，因此存在一种可能的情况，即租户A和租户B将他们的VM或PM的IP设置成相同的，为了避免将租户A的机器和租户B的机器混淆，这时对于服务提供商而言则需要区分两个租户的机器。
针对上述问题，控制器可以为每个租户的VPC分配隔离标签，然后控制器将隔离标签同PM、VM对应的转发表项同时下发至各个系统网关和交换机。当后续租户A、租户B的VM都同时与各自的PM进行通信时，控制器可以通过该隔离标签封装在转发表项中的方式进行通信路径的隔离。
在上述实施例的图1所示的虚拟私有云通信系统的基础上进行改进，参见图2，本申请还提供了另一种虚拟私有云通信系统，该虚拟私有云通信系统还包括控制器20，该控制器分别与系统网关和交换机通信连接，对该系统网关和交换机进行信息配置，生成配置信息，并将该配置信息分别发送至系统网关和交换机，从而便于后续数据传输。
在可能的实施例中，上述控制器与VM所在的宿主机、PM对应的带外管理系统连接，根据租户需求通过该宿主机及带外管理系统，进行资源配置和信息配置，并得到配置信息，上述带外管理系统是指对PM进行初始化(例如重新安装操作系统)的管理系统，具体过程如下：
(a1)接收租户的资源创建请求。
例如，租户可以通过租户终端(可以为移动终端或者是电脑)直接调用相应的API(Application Programming Interface，应用程序编程接口)，或者是 登录WEB(World Wide Web，全球广域网)控制台调用相应的API。根据实际需求填写相应的需求信息，如所需CPU的类型，内存大小，网卡需求等，从而生成资源创建请求，并发送至控制器。
(a2)根据上述资源创建请求为租户分配资源，该资源构成租户的VPC。
其中VPC的资源包括VM和/或PM，即VM和/或PM构成租户的VPC。
控制器在接收到上述资源创建请求后，进行逻辑计算，确定需要的资源，并通过宿主机的管理单元及带外管理系统在资源池(宿主机及PM)里面分配可用资源。如果确定有满足要求的资源，则进行配置操作，分配相应数量的VM和/或PM，该VM和/或PM构成该租户对应的VPC；如果没有满足要求的资源则返回给客户资源不足信息等信息。
示例性地，控制器在接收租户的资源创建请求后，可以根据资源创建请求中需求的CPU的类型，内存大小，网卡传输速率，从资源池中选择符合上述需求的PM作为目标宿主机，这便是上面提到的逻辑计算过程，然后，控制器可以在目标宿主机中创建VM。本发明实施例中，资源池中包括多种类型的PM，有的PM可以作为宿主机，有的PM可以用于图像、声音、视频处理，这些PM中可以仅包含GPU，则可以在租户有GPU使用需求时，如图像、声音、视频处理需求时，可以直接将这些GPU作为PM分配给租户，换言之，这些仅包含GPU的PM可以作为PM的其中一个类别。上述宿主机的管理单元是指一台作为宿主机的PM中用于管理自身各VM的配置参数的单元，上述带外管理系统是指对PM进行初始化(例如重新安装操作系统)的管理系统，带外管理系统可以独立于图2所示的网络运行，并可以与控制器交互。可以理解是，由于管理单元用于对宿主机中的VM进行管理，带外管理系统用于对PM进行管理，因此，控制器可以通过与管理单元与带外管理系统的交互，在资源池中选择一台符合租户需求的PM作为宿主机。
(a3)基于每个虚拟私有云VPC生成与该VPC对应的隔离标签。
其中，该隔离标签可以通过相应的数字、字母和/或特殊符号等组成。
(a4)获取属于同一个虚拟私有云VPC的资源的IP地址。
其中，该资源包括VM和/或PM，上述IP地址包括VM的IP地址和PM的IP地址，也就是说，上述所获取的IP地址，是指属于同一VPC的VM和/ 或PM的IP地址。
具体地，在租户终端在配置过程中，可以对PM和VM所在的网段进行自定义。例如，通过调用相应的API，对VPC内的VM和PM进行IP配置，并发送相应的IP信息至控制器。
当VM与系统网关通信连接时，该VM可以自动获取其对应的IP。当PM通过交换机与该系统网关通信时，该PM也可以自动获取其对应的IP。具体地，上述IP配置具体可以通过系统网关内的DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)服务器实现，在VM和PM开机时，VM和PM作为DHCP客户机与DHCP服务器交互，从而获得相应的IP。
(a5)基于资源的IP地址建立转发表项。
其中，该转发表项的建立过程具体包括：基于VM的IP地址建立VM的转发表项，和/或基于PM的IP地址建立PM的转发表项。
由此可以通过上述建立相应的转发表项，后续可以直接根据该转发表项进行数据传输。
其中，PM的转发表项包含源PM的源IP地址以及目标PM的目标IP地址，VM的转发表项包含源VM的源IP地址以及目标VM的目标IP地址。
(a6)根据上述转发表项和上述隔离标签生成与VPC对应的配置信息。
在获取到租户的VPC的隔离标签，及该VPC内VM的转发表项和/或PM的转发表项后，生成配置信息(该配置信息包含VM的转发表项和/或PM的转发表项，及隔离标签的信息)。控制器在生成配置信息后，将该配置信息配置到系统网关及交换机，以便于数据传输(即数据报文转发)时使用。
为了满足租户的多样化需求，便于租户对VPC进行控制与管理，提高租户体验，在可能的实施例中，上述控制器还用于基于上述配置信息管理虚拟私有云VPC内的资源。该管理包括：增加资源和/或删除资源。即通过控制器租户可以添加VPC中的VM或者PM，或者删除VPC中的VM与PM。
在具体实现过程中，上述控制器还用于：(1)接收对VPC内的资源的管理操作请求；其中，该管理操作请求包括待管理的VPC对应的隔离标签；(2)根据上述隔离标签修改系统网关及交换机中与待管理的VPC对应的配置信息。
通过修改配置信息，可以对该VPC中的资源进行管理，如需要扩大VPC 资源时，可以在系统网关及交换机中添加扩展后的资源对应的配置信息，从而后期实现扩展后的VM和PM的相互通信。
在可能的实施例中，上述管理操作请求可以但不限于包括资源增加请求、资源部分删除请求及资源全部删除请求。基于此，上述控制器还用于基于资源增加请求增加与资源IP地址对应的转发表项；和/或基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或基于资源全部删除请求删除与待管理的VPC对应的配置信息。
例如，上述控制器对资源增加请求的具体处理过程包括：
(b1)接收租户发送的对VPC中资源的资源增加请求。
其中该资源增加请求包括待添加VPC对应的隔离标签。
例如，租户可以通过租户终端(可以为移动终端或者是电脑)直接调用相应的API，或者是登录WEB控制台调用相应的API。通过该API，选择添加VPC的VM或者PM。
(b2)基于资源增加请求增加与资源IP地址对应的转发表项。
即，在待添加VPC中添加资源(VM和/或PM)后，为相应的VM和/或建立转发表项，并将该转发表项添加至待添加VPC的配置信息中。
(b3)将更新后的配置信息发送至系统网关及交换机。
具体地，可以按照上述配置信息是根据上述步骤(a1)至(a6)的步骤生成的。
上述控制器对资源部分删除请求包括：
参见上述步骤(b1)和步骤(b3)，在现有的配置信息中删除VPC中待删除的资源对应的转发表项，然后将更新后的配置信息发送至系统网关及交换机。
而对于资源全部删除请求，控制器可以直接根据该资源全部删除请求中的隔离标签，控制系统网关和交换机中删除待管理的VPC的配置信息。
在可能的实施例中，控制器在接收到上述资源全部删除请求或者资源部分删除请求后，通过VM对应的宿主机和PM对应的带外管理系统，使得相应的VM和PM由已配置状态变更为未配置状态，以便于后续的循环使用。
由此，通过隔离标签的设置，可以将不同租户的不同VPC隔离开来，互 不干扰，为各个VPC提供了安全策略防护能力；同时在进行删除操作和添加操作时，可以实现仅对操作的租户对应的VPC的配置信息进行更新，而不影响其他租户的配置信息，增加了租户添加和删除VPC中VM和PM的灵活性。
综上所述，在具体应用时，数据在VM与PM之间的传输过程中，系统网关的作用如下：
在VM至PM方向的传输过程中，系统网关用于：接收VM的第一报文；该第一报文包括隔离标签；基于第一报文中的隔离标签找到与隔离标签对应的配置信息，并基于找到的配置信息将第一报文转发至对应的交换机。
在PM至VM方向的传输过程中，系统网关还用于接收所述交换机的第二报文；其中，该第二报文包括隔离标签；基于该第二报文中的隔离标签找到与隔离标签对应的配置信息，并基于找到的配置信息将第二报文转发至目标VM。
交换机的作用如下：
在PM至VM方向的传输过程中，交换机用于接收PM的第三报文；其中，该第三报文包括隔离标签；基于第三报文中的隔离标签找到与隔离标签对应的配置信息，并基于找到的配置信息将第三报文转发至对应的系统网关。
在VM至PM方向的传输过程中，交换机还用于接收上述系统网关的第四报文；其中，该第四报文包括隔离标签；基于该第四报文中的隔离标签找到与隔离标签对应的配置信息，并基于找到的配置信息将第四报文转发至目标PM。
为了便于从公共网络中获取相应的数据，在另外的实施例中，上述虚拟私有云通信系统还可以与公共网络如Internet连接，在可能的实施例中，参见图3，该虚拟私有云系统中的VM通过网络网关30与公共网络连接。而虚拟私有云系统中的PM依次通过对应的交换机、系统网关、网络网关30与公共网络连接。
在前面描述的系统中，主要涉及到的两个部分：系统网关实现以及配置管理和PM的交换机的配置与管理。但是在本申请中的虚拟私有云通信系统中，如PM与PM、PM与其他网元(包括VM、Internet(互联网))通信，也在网络转发过程中扮演举足轻重的角色。随着云环境规模增大，通信设备之 间的压力也会线性增加。交换机为线速转发设备，它的压力主要体现在大规模下配置和管理上，而系统网关为X86上运行软件实现的网关，性能不及交换机，它的压力则主要体现在网络转发上。
交换机的管理和配置方面：PM形成的物理机区域在超大规模环境下，交换机上的转发表项也成倍增加，若依赖设备间防洪学习，会在该物理机区域中带来广播风暴，消耗相应带宽。此时若交换机仅支持二层转发设备，即为二层转发设备，为了支持PM间跨三层通信则所有的PM所需的网关会由系统网关实现，即必须经过系统网关，因此为系统网关带来较大的压力。基于此，在本虚拟私有云通信系统中，交换机为支持隧道协议的三层交换机，支持三层转发，配合EVPN(Ethernet Virtual Private Network，以太网虚拟专用网)技术来同步交换机间的转发表项，以将PM所需的网关从系统网关转移到交换机，此后PM之间的通信则可通过交换机直接转发。
系统网关转发性能方面：系统网关的转发性能好坏完全依赖软件架构的实现，若采用Linux内核转发，由于Linux的网络协议栈庞大和繁冗，在处理网络转发方面势必不理想。而DPDK(Data Plane Development Kit，数据平面开发套件)技术是可让网络转发逻辑可在Linux系统的租户空间上实现，绕过Linux网络协议栈让系统网关的转发程序直接操作网卡来获取和发送数据报文，可以极大提高数据处理性能和吞吐量。因此，在后续报文转发过程中，可以采用DPDK技术实现。
本申请中的虚拟私有云系统，为物理机区域与虚拟机区域以及公共网络(如Internet)建立了沟通桥梁，可使虚拟机区域和物理机区域中资源形成大规模的VPC，无需受限于VLAN ID数量的上限值；同时可为VPC提供安全策略防护能力，使租户可以按照业务需求，灵活的配比虚拟机和物理机资源。
在上述系统实施例的基础上，本申请实施例还提供了一种虚拟私有云通信系统的系统配置方法，该方法应用于如上述系统实施例中的控制器，如图4所示，该虚拟私有云通信系统的系统配置方法，具体包括：
步骤S401，分别对系统网关和交换机进行信息配置，生成配置信息；
步骤S402，将配置信息分别发送至系统网关和交换机；
其中该配置信息包括与所述VPC对应的隔离标签；该配置信息还包括与对应的VPC包括的资源的转发表项；该资源包括：VM和/或PM。
上述步骤S402中生成配置信息的步骤，包括：基于每个虚拟私有云VPC生成与VPC对应的隔离标签；获取属于同一个虚拟私有云VPC的资源的IP地址；基于资源的IP地址建立转发表项；根据转发表项和隔离标签生成与VPC对应的配置信息。
上述基于资源的IP地址建立转发表项的步骤，包括：基于VM的IP地址建立该VM的转发表项，和/或基于PM的IP地址建立该PM的转发表项。
进一步地，上述方法还包括：基于上述配置信息管理虚拟私有云VPC内的资源；该管理包括：增加资源和/或删除资源。
进一步地，上述方法还包括：接收对VPC内的资源的管理操作请求；其中，上述管理操作请求包括待管理的VPC对应的隔离标签；根据隔离标签修改系统网关及交换机中与待管理的VPC对应的配置信息。
进一步地，上述管理操作请求包括资源增加请求、资源部分删除请求、资源全部删除请求中的一种或者多种，上述方法还包括：基于资源增加请求增加与资源IP地址对应的转发表项；和/或基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或基于资源全部删除请求删除与所述待管理的VPC对应的配置信息。
进一步地，基于上述实施例二中交换机的管理和配置方面的描述，虚拟私有云通信系统的交换机为三层交换机，支持隧道协议；上述虚拟私有云通信方法还包括：利用EVPN技术同步PM对应的交换机之间的转发表项，以将PM所需的网关从系统网关转移到交换机，此后PM之间的通信则可通过交换机直接转发，有效减少了系统网关的转发压力。
参见图5，本申请实施例还提供一种控制器100，包括：处理器40，存储器41，总线42和通信接口43，所述处理器40、通信接口43和存储器41通过总线42连接；处理器40用于执行存储器41中存储的可执行模块，例如计算机程序。
其中，存储器41可能包含高速随机存取存储器(RAM，Random Access  Memory)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。通过至少一个通信接口43(可以是有线或者无线)实现该系统网元与至少一个其他网元之间的通信连接，可以使用互联网，广域网，本地网，城域网等。
总线42可以是ISA总线、PCI总线或EISA总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图5中仅用一个双向箭头表示，但并不表示仅有一根总线或一种类型的总线。
其中，存储器41用于存储程序，所述处理器40在接收到执行指令后，执行所述程序，前述本申请实施例任一实施例揭示的流过程定义的装置所执行的方法可以应用于处理器40中，或者由处理器40实现。
处理器40可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器40中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器40可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(Digital Signal Processing，简称DSP)、专用集成电路(Application Specific Integrated Circuit，简称ASIC)、现成可编程门阵列(Field-Programmable Gate Array，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器41，处理器40读取存储器41中的信息，结合其硬件完成上述方法的步骤。
本申请实施例提供的虚拟私有云通信系统的系统配置方法及控制器，与上述实施例提供的虚拟私有云通信系统具有相同的技术特征，所以也能解决相同的技术问题，达到相同的技术效果。
本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质 内存储有计算机程序，用以执行前述方法实施例中所述的虚拟私有云通信系统的系统配置方法。
本申请实施例所提供的进行系统配置方法的计算机程序产品，包括存储了处理器可执行的非易失的程序代码的计算机可读存储介质，所述程序代码包括的指令可用于执行前述方法实施例中所述的虚拟私有云通信系统的系统配置方法，具体实现可参见方法实施例，在此不再赘述。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的方法及控制器的具体工作过程，可以参考前述系统实施例中的对应过程，在此不再赘述。
附图中的流程图和框图显示了根据本申请的多个实施例方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，所述模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
在本申请的描述中，需要说明的是，术语“中心”、“上”、“下”、“左”、“右”、“竖直”、“水平”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本申请和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本申请的限制。此外，术语“第一”、“第二”、“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性。除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对步骤、数字表达式和数值并不限制本申请的范围。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、方法，可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如， 所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，又例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个处理器可执行的非易失的计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上所述实施例，仅为本申请的具体实施方式，用以说明本申请的技术方案，而非对其限制，本申请的保护范围并不局限于此，尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，其依然可以对前述实施例所记载的技术方案进行修改或可轻易想到变化，或者对其中部分技术特征进行等同替换；而这些修改、变化或者替换，并不使相应技术方案的本质脱离本申请实施例技术方案的精神和范围，都应涵盖在本申 请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (20)

  1. 一种虚拟私有云通信系统，其特征在于，包括：至少一个虚拟机VM以及与每个所述VM通信连接的系统网关；
    至少一个物理机PM以及与每个所述PM通信连接的交换机；
    所述系统网关与所述交换机通信连接；
    所述系统网关和所述交换机用于基于预设的配置信息使属于同一个虚拟私有云VPC内的所述VM与所述PM之间能够进行通信。
  2. 根据权利要求1所述的系统，其特征在于，
    所述配置信息包括与所述VPC对应的隔离标签；
    所述配置信息还包括与对应的所述VPC包括的资源的转发表项；
    所述资源包括：VM和/或PM。
  3. 根据权利要求1所述的系统，其特征在于，还包括控制器；
    所述控制器分别与所述系统网关和所述交换机通信连接；
    所述控制器用于分别对所述系统网关和所述交换机进行信息配置，生成配置信息，并将所述配置信息分别发送至所述系统网关和所述交换机。
  4. 根据权利要求3所述的系统，其特征在于，所述控制器还用于：
    基于每个虚拟私有云VPC生成与所述VPC对应的隔离标签；
    获取属于同一个虚拟私有云VPC的资源的IP地址；所述资源包括VM和/或PM；
    基于资源的IP地址建立转发表项；
    根据所述转发表项和所述隔离标签生成与所述VPC对应的配置信息。
  5. 根据权利要求4所述的系统，其特征在于，所述控制器还用于，
    基于所述VM的IP地址建立所述VM的转发表项，和/或
    基于所述PM的IP地址建立所述PM的转发表项。
  6. 根据权利要求3所述的系统，其特征在于，所述控制器还用于：
    基于所述配置信息管理所述虚拟私有云VPC内的资源；所述资源包括VM和/或PM；所述管理包括：增加资源和/或删除资源。
  7. 根据权利要求6所述的系统，其特征在于，所述控制器还用于：
    接收对所述VPC内的资源的管理操作请求；其中，所述管理操作请求包括待管理的VPC对应的隔离标签；
    根据所述隔离标签修改所述系统网关及所述交换机中与所述待管理的VPC对应的配置信息。
  8. 根据权利要求7所述的系统，其特征在于，所述控制器还用于：
    基于资源增加请求增加与资源IP地址对应的转发表项；和/或
    基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或
    基于资源全部删除请求删除与所述待管理的VPC对应的配置信息。
  9. 根据权利要求2所述的系统，其特征在于，所述系统网关用于：
    接收所述VM的第一报文；所述第一报文包括隔离标签；
    基于所述第一报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第一报文转发至对应的交换机；
    所述系统网关还用于：
    接收所述交换机的第二报文；其中，所述第二报文包括隔离标签；
    基于所述第二报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第二报文转发至目标VM。
  10. 根据权利要求2所述的系统，其特征在于，所述交换机用于：
    接收所述PM的第三报文；所述第三报文包括隔离标签；
    基于所述第三报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第三报文转发至对应的系统网关；
    所述交换机还用于：
    接收所述系统网关的第四报文；其中，所述第四报文包括隔离标签；
    基于所述第四报文中的隔离标签找到与所述隔离标签对应的配置信息，并基于找到的配置信息将所述第四报文转发至目标PM。
  11. 根据权利要求1-10任一项所述的系统，其特征在于，所述系统网关是通过在服务器中运行相应软件实现的。
  12. 一种虚拟私有云通信系统的系统配置方法，其特征在于，应用于权利要求1至11任一项所述的系统中的控制器，所述控制器分别与所述系统网关和所述交换机通信连接；所述方法包括：
    分别对所述系统网关和所述交换机进行信息配置，生成配置信息；
    并将所述配置信息分别发送至所述系统网关和所述交换机；
    其中所述配置信息包括与所述VPC对应的隔离标签；所述配置信息还包括与对应的所述VPC包括的资源的转发表项；所述资源包括：VM和/或PM。
  13. 根据权利要求12所述的方法，其特征在于，所述生成配置信息的步骤，包括：
    基于每个虚拟私有云VPC生成与所述VPC对应的隔离标签；
    获取属于同一个虚拟私有云VPC的资源的IP地址；所述资源包括VM和/或PM；
    基于资源的IP地址建立转发表项；
    根据所述转发表项和所述隔离标签生成与所述VPC对应的配置信息。
  14. 根据权利要求13所述的方法，其特征在于，所述基于资源的IP地址建立转发表项的步骤，包括：
    基于所述VM的IP地址建立所述VM的转发表项，和/或
    基于所述PM的IP地址建立所述PM的转发表项。
  15. 根据权利要求12所述的方法，其特征在于，还包括：
    基于所述配置信息管理所述虚拟私有云VPC内的资源；所述资源包括VM和/或PM；所述管理包括：增加资源和/或删除资源。
  16. 根据权利要求15所述的方法，其特征在于，还包括：
    接收对所述VPC内的资源的管理操作请求；其中，所述管理操作请求包括待管理的VPC对应的隔离标签；
    根据所述隔离标签修改所述系统网关及所述交换机中与所述待管理的VPC对应的配置信息。
  17. 根据权利要求16所述的方法，其特征在于，所述管理操作请求包括资源增加请求、资源部分删除请求、资源全部删除请求中的一种或者多种，所述方法还包括：
    基于资源增加请求增加与资源IP地址对应的转发表项；和/或
    基于资源部分删除请求删除与资源IP地址对应的转发表项；和/或
    基于资源全部删除请求删除与所述待管理的VPC对应的配置信息。
  18. 一种控制器，包括存储器、处理器，所述存储器上存储有可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现上述权利要求12至17任一项所述的方法。
  19. 一种计算机可读存储介质，所述存储介质上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求12至17任一项所述的方法。
  20. 一种应用程序，其特征在于，用于在运行时执行：权利要求12-17任一项所述的方法。
PCT/CN2019/117498 2018-11-30 2019-11-12 虚拟私有云通信系统、系统配置方法及控制器 WO2020108292A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
SG11202105560WA SG11202105560WA (en) 2018-11-30 2019-11-12 Virtual private cloud communication system, system configuration method and controller

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811463985.6A CN111262771B (zh) 2018-11-30 2018-11-30 虚拟私有云通信系统、系统配置方法及控制器
CN201811463985.6 2018-11-30

Publications (1)

Publication Number Publication Date
WO2020108292A1 true WO2020108292A1 (zh) 2020-06-04

Family

ID=70854280

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/117498 WO2020108292A1 (zh) 2018-11-30 2019-11-12 虚拟私有云通信系统、系统配置方法及控制器

Country Status (3)

Country Link
CN (1) CN111262771B (zh)
SG (1) SG11202105560WA (zh)
WO (1) WO2020108292A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113472745A (zh) * 2021-05-31 2021-10-01 山东英信计算机技术有限公司 一种基于selinux的openstack公有云多租户隔离方法、系统及终端
CN114615139A (zh) * 2022-03-17 2022-06-10 苏州浪潮智能科技有限公司 交换机自动配置管理方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090293055A1 (en) * 2008-05-22 2009-11-26 Carroll Martin D Central Office Based Virtual Personal Computer
CN106998284A (zh) * 2016-01-25 2017-08-01 阿里巴巴集团控股有限公司 通过虚拟私有网络连接私有网络的网络系统和方法
WO2017214883A1 (en) * 2016-06-15 2017-12-21 Alibaba Group Holding Limited Network system and method for cross region virtual private network peering
CN107770064A (zh) * 2016-08-19 2018-03-06 华为技术有限公司 一种跨网络通信的方法、设备
CN108462594A (zh) * 2017-02-21 2018-08-28 阿里巴巴集团控股有限公司 虚拟专有网络及规则表生成方法、装置及路由方法

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103516733A (zh) * 2012-06-19 2014-01-15 华为技术有限公司 一种虚拟私有云的处理方法及装置
US9331946B2 (en) * 2013-01-08 2016-05-03 Hitachi, Ltd. Method and apparatus to distribute data center network traffic
CN104283755B (zh) * 2013-07-01 2018-10-30 阿里巴巴集团控股有限公司 一种虚拟专用云接入方法及系统
CN103607430B (zh) * 2013-10-30 2018-04-27 中兴通讯股份有限公司 一种网络处理的方法和系统及网络控制中心
CN103607308B (zh) * 2013-11-29 2016-09-21 杭州东信北邮信息技术有限公司 云计算环境下的虚拟机多网络管理系统和方法
WO2015100656A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种实现虚拟机通信的方法和装置
CN104954281B (zh) * 2014-03-31 2018-08-03 中国移动通信集团公司 通信方法、系统、资源池管理系统、交换机和控制装置
US10225207B2 (en) * 2014-08-25 2019-03-05 International Business Machines Corporation Managing hybrid cloud placement policies
CN104461683B (zh) * 2014-11-07 2017-11-24 华为技术有限公司 一种虚拟机非法配置的校验方法、装置及系统
CN104580505A (zh) * 2015-01-26 2015-04-29 中国联合网络通信集团有限公司 一种租户隔离方法及系统
CN105376303B (zh) * 2015-10-23 2018-11-06 深圳前海达闼云端智能科技有限公司 一种Docker实现系统及其通信方法
CN105354076B (zh) * 2015-10-23 2019-01-25 北京云端光科技术有限公司 一种应用部署方法及装置
CN105429938B (zh) * 2015-10-23 2018-11-06 深圳前海达闼云端智能科技有限公司 一种资源配置方法及装置
CN105591955B (zh) * 2015-10-30 2019-07-09 新华三技术有限公司 一种报文传输的方法和装置
US10348556B2 (en) * 2016-06-02 2019-07-09 Alibaba Group Holding Limited Method and network infrastructure for a direct public traffic connection within a datacenter
CN106375176B (zh) * 2016-08-29 2019-01-22 无锡华云数据技术服务有限公司 一种物理机接入云平台的方法
CN106559511B (zh) * 2016-10-18 2019-05-24 优刻得科技股份有限公司 云系统、云端公共服务系统及用于云系统的互访方法
CN106789667B (zh) * 2016-11-21 2021-01-01 华为技术有限公司 一种数据转发方法、相关设备及系统
CN106789367A (zh) * 2017-02-23 2017-05-31 郑州云海信息技术有限公司 一种网络系统的构建方法及装置
CN107135134B (zh) * 2017-03-29 2019-09-13 广东网金控股股份有限公司 基于虚拟交换机和sdn技术的私用网络接入方法和系统
CN110351191B (zh) * 2018-04-20 2020-12-11 腾讯科技（深圳）有限公司 网络配置方法、系统、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090293055A1 (en) * 2008-05-22 2009-11-26 Carroll Martin D Central Office Based Virtual Personal Computer
CN106998284A (zh) * 2016-01-25 2017-08-01 阿里巴巴集团控股有限公司 通过虚拟私有网络连接私有网络的网络系统和方法
WO2017214883A1 (en) * 2016-06-15 2017-12-21 Alibaba Group Holding Limited Network system and method for cross region virtual private network peering
CN107770064A (zh) * 2016-08-19 2018-03-06 华为技术有限公司 一种跨网络通信的方法、设备
CN108462594A (zh) * 2017-02-21 2018-08-28 阿里巴巴集团控股有限公司 虚拟专有网络及规则表生成方法、装置及路由方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113472745A (zh) * 2021-05-31 2021-10-01 山东英信计算机技术有限公司 一种基于selinux的openstack公有云多租户隔离方法、系统及终端
CN113472745B (zh) * 2021-05-31 2023-04-07 山东英信计算机技术有限公司 一种基于selinux的openstack公有云多租户隔离方法、系统及终端
CN114615139A (zh) * 2022-03-17 2022-06-10 苏州浪潮智能科技有限公司 交换机自动配置管理方法、装置、电子设备及存储介质
CN114615139B (zh) * 2022-03-17 2023-08-29 苏州浪潮智能科技有限公司 交换机自动配置管理方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
SG11202105560WA (en) 2021-06-29
CN111262771A (zh) 2020-06-09
CN111262771B (zh) 2021-06-22

Similar Documents

Publication Publication Date Title
US11563669B2 (en) Method for implementing network virtualization and related apparatus and communications system
US11502920B1 (en) Multi-carrier access to provider substrate extensions
CN112217746B (zh) 云计算系统中报文处理的方法、主机和系统
US10664301B2 (en) Methods and systems for establishing connections associated with virtual machine migrations
AU2016414391B2 (en) Packet processing method in cloud computing system, host, and system
US10484515B2 (en) Implementing logical metadata proxy servers in logical networks
US9893977B2 (en) System and method for supporting live migration of virtual machines in a virtualization environment
US9749145B2 (en) Interoperability for distributed overlay virtual environment
US9031081B2 (en) Method and system for switching in a virtualized platform
US9742726B2 (en) Distributed dynamic host configuration protocol
WO2017113231A1 (zh) 一种报文传输的方法、装置和系统
US11159344B1 (en) Connectivity of cloud edge locations to communications service provider networks
US11095716B2 (en) Data replication for a virtual networking system
WO2022063170A1 (zh) 一种公有云的网络配置方法及相关设备
CN110870290B (zh) 对逻辑网络地址分配唯一的网络地址
US20190220299A1 (en) Server support for multiple audio/video operating systems
WO2020108292A1 (zh) 虚拟私有云通信系统、系统配置方法及控制器
WO2022160714A1 (zh) 一种通信方法、装置以及系统
US20220283866A1 (en) Job target aliasing in disaggregated computing systems
CN118541674A (zh) 发布用于图形处理单元工作负载的物理拓扑网络局部性信息
RU2788969C2 (ru) Система связи в виртуальном частном облаке, способ конфигурирования системы и контроллер
CN116724546A (zh) 用于融合以太网上的RDMA（RoCE）云规模多租赁
TW202339463A (zh) 增強之端點多播模擬
CN115686730A (zh) 一种虚拟机迁移方法、装置、设备及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19890292

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19890292

Country of ref document: EP

Kind code of ref document: A1